One script. 15 steps. Hardening, privacy, developer tooling, GNOME configuration, and optional third-party software — fully automated, fully auditable.
Built for people who know what they want. Every step is transparent, every default is documented, every choice is overridable.
Locks root, installs USBGuard, stops and masks risky services, removes legacy packages. Three profiles: desktop, enterprise, server.
Mutes audio, kills mic, disables remote desktop, clears bash history, removes recent files tracking. Off by default, opt back in.
Multiple profiles, hardened or relaxed user.js, uBlock Origin + Privacy Badger, optional extension set. All automated.
Docker, GitHub CLI, Signal, VSCode, Brave, ProtonVPN, Slack and more — each via its official repo. One flag, no manual repo setup.
Already-installed packages, repos, and fonts are skipped. Safe to re-run. Checks for conflicting apt processes before starting.
Theme, GTK variant, background color, dock size, Night Light temperature, keyboard layouts, power profile — all from the CLI.
Download the script, review it, run it. No installer, no package, no PPA.
# Download curl -O https://raw.githubusercontent.com/franckferman/ubuntu-post-install/main/ubuntu-post-install.sh # Run with defaults — dark theme, performance, all 15 steps bash ubuntu-post-install.sh # Developer setup bash ubuntu-post-install.sh --extras devops,vscode,signal --apps-profile extra # Privacy-first workstation bash ubuntu-post-install.sh --extras privacy --firefox-profiles main --firefox-hardened-profiles main # VPS / headless server bash ubuntu-post-install.sh --hardening-profile server --no-lock-root --no-snap --no-mullvad --steps 1,2,4,5
Use --steps 1,3-7,15 to run exactly what you need. Each step is fully independent.
Full apt upgrade, autoclean, autoremove. The obvious first step.
Installs and configures your chosen engine with hardened (drop all incoming) or transparent profile.
GNOME theme, privacy controls, audio, power profile, Night Light, keyboard layouts, dock size.
Root lock, USBGuard, risky services masked, legacy packages removed. CIS Ubuntu Benchmark aligned.
APT packages (minimal/default/extra profile), Obsidian, OnlyOffice, Mullvad VPN.
Creates profiles, applies arkenfox user.js in hardened or relaxed mode, installs extensions.
vim-plug + gruvbox + NERDTree + vim-airline. Or minimal (no plugin manager) or bare (zero deps).
Neovim + LazyVim starter distribution — the modern Neovim setup.
Downloads the latest release from GitHub, installs to ~/.local/share/fonts. Required for Powerlevel10k glyphs.
Unattended Oh My Zsh install. Sets Zsh as the default shell.
Powerlevel10k theme, autosuggestions, syntax highlighting, completions.
Extended plugin set for a productive terminal.
Custom alias block written to .zshrc.
Bundled p10k preset applied with optional custom segment overrides.
Third-party APT repos and Snap packages. Official sources, idempotent, grouped or individual.
Each extra configures the official keyring and APT source, then installs the package. Groups deduplicate automatically — mix freely.
# Groups --extras all --extras browsers --extras devops,privacy # Individuals --extras docker,gh,signal # Mix --extras microsoft,signal,spotify
All flags are parsed before execution. Order doesn't matter.
ufw, nftables, iptables (default: ufw)hardened or transparent (default: hardened)desktop / enterprise / server (default: desktop)dark / light / auto (default: dark)performance / balanced / power-saverus,fr+azertyminimal / default / extraapt / direct / githubboth / vim / neovim / nonefull / minimal / bare1,3-7,15bash ubuntu-post-install.sh \ --apps-profile extra \ --extras devops,vscode,signal \ --editor both \ --power-profile performance
bash ubuntu-post-install.sh \ --extras privacy \ --firefox-profiles work,personal \ --firefox-hardened-profiles work \ --firefox-relaxed-profiles personal
bash ubuntu-post-install.sh \ --hardening-profile enterprise \ --keep-avahi --keep-cups \ --extras microsoft \ --keyboard-layouts us,fr
bash ubuntu-post-install.sh \ --hardening-profile server \ --no-lock-root --no-snap \ --no-mullvad \ --steps 1,2,4,5
bash ubuntu-post-install.sh \ --bg-color '#1e1e2e' \ --gtk-theme Yaru-purple-dark \ --night-light-temp 3200 \ --dock-icon-size 48
# Hardening and apps only bash ubuntu-post-install.sh --steps 4,5 # Install all extras bash ubuntu-post-install.sh --extras all --steps 15
One script. Auditable. No internet requirements after download (for most steps).